NetSec-Architect Practice Test 6 — 10 Questions

Question 1

An enterprise security architect is designing an intrusion prevention and threat intelligence architecture. Which TWO of the following statements accurately describe the behavior and capabilities of Palo Alto Networks Threat Prevention and CDSS integration? (Choose two)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Threat intelligence feeds can automatically integrate dynamic threat indicators via External Dynamic Lists (EDLs) without requiring firewall reboots or commits.. Threat Prevention inspects traffic bi-directionally for known exploits, and cloud threat intelligence automatically synchronizes threat signatures and IOCs globally to protect against zero-days and known attacks.

Answer

Vulnerability Protection signatures require manual administrator intervention every hour to compile raw C code on the firewall dataplane.

Answer

DNS Security profiles can only be applied to hardware firewalls and are unsupported in virtualized firewall form factors (VM-Series).

Answer

WildFire cloud updates are dependent on manual file hashing performed exclusively by local administrators via CLI.

Question 2

An architect is designing an enterprise security architecture utilizing External Dynamic Lists (EDLs). Which THREE sources or formats are natively supported by Palo Alto Networks NGFWs for EDL consumption? (Choose three)

Accepted Answer

Domain name lists for DNS Security and URL filtering. Palo Alto Networks NGFWs natively support EDLs formatted as plain text lists of IP addresses, URLs, or domains, sourced via HTTP/HTTPS or maintained through integrations like Cortex XSOAR and DNS lists.

Answer

Active Directory group membership SID tokens

Answer

Local ESXi hypervisor VM memory dump files

Question 3

When designing AI application security using Palo Alto Networks capabilities, an architect wants to protect internal Large Language Models (LLMs) from prompt injection attacks and data exfiltration. Which product suite provides native LLM security posture management and runtime defense?

Accepted Answer

Prisma Cloud Application Security / AI Security posture management. Prisma Cloud provides LLM security posture management (DSPM for AI) and runtime visibility for AI applications, securing AI models and pipelines.

Answer

Cortex XDR agent

Answer

Prisma Access Mobile Users

Answer

WildFire cloud-based malware analysis

Question 4

An enterprise is deploying Enterprise DLP to inspect encrypted traffic. What architectural prerequisite must be met on the Palo Alto Networks firewall for Enterprise DLP to successfully inspect and detect sensitive data in HTTPS sessions?

Accepted Answer

SSL Decryption must be configured and enabled to decrypt outbound traffic before DLP inspection can occur.. Since Enterprise DLP inspects application payloads (like HTTP/S, SMTP, FTP), SSL Decryption must be active to decrypt TLS traffic so the DLP engine can read the payload.

Answer

WildFire inline machine learning must be enabled on all security zones.

Answer

Prisma Access Cloud Secure Web Gateway must be configured in explicit proxy mode.

Answer

User-ID must be mapped to Kerberos credential caches to extract user context for DLP alerts.

Question 5

An architect is designing mobile user security with Prisma Access and needs to ensure that all DNS queries from mobile devices are inspected and secured. Which Prisma Access feature handles DNS security for mobile users?

Accepted Answer

Prisma Access DNS Security service applied via Anti-Spyware / DNS Security profiles.. Prisma Access integrates DNS Security services to analyze DNS requests, block malicious domains, and prevent C2 communication over DNS.

Answer

Local client DNS caching configured in GlobalProtect settings.

Answer

GlobalProtect split-tunnel DNS exclusion lists.

Answer

SD-WAN DNS proxy forwarding.

Question 6

An architect is reviewing the deployment of DNS Security. Which THREE security use cases are directly addressed by the DNS Security cloud-delivered service? (Choose three)

Accepted Answer

Identification and blocking of known malicious domains associated with botnets and malware distribution.. DNS Security addresses DGA domains, DNS tunneling, and known malicious domains/C2 servers operating over DNS.

Answer

Automatic compilation of physical switch VLAN trunking protocols (VTP).

Answer

Local static IP address assignment for DHCP client reservations on corporate VLANs.

Question 7

An architect is deploying Prisma Access for users who require explicit proxy settings due to strict corporate network egress policies. How should the architect configure Prisma Access to support explicit proxy connections for mobile users?

Accepted Answer

Configure explicit proxy settings in the GlobalProtect app configuration in Panorama, specifying the Prisma Access explicit proxy IP and port.. Prisma Access supports explicit proxy for mobile users by configuring explicit proxy settings within the GlobalProtect client configuration and provisioning proxy listeners in the cloud.

Answer

Deploy an internal hardware firewall running PAN-OS in proxy mode and tunnel all traffic via IPsec to Prisma Access.

Answer

Enable explicit proxy mode inside the Decryption Profile attached to the mobile user security policy.

Answer

Modify the DNS proxy settings on the local branch router to resolve all explicit proxy requests to the local gateway.

Question 8

An architect is reviewing the deployment requirements for Advanced Threat Prevention on a Palo Alto Networks firewall. Which TWO architectural components are core elements of Advanced Threat Prevention compared to standard threat prevention? (Choose two)

Accepted Answer

Recommended signatures applied automatically based on threat severity and exploit risk. Advanced Threat Prevention introduces inline machine learning for command-and-control detection and unique signature-less threat prevention engines designed to stop evasive and unknown attacks in real time.

Answer

Static signature matching based strictly on pre-compiled MD5 file hashes

Answer

Local management plane database storage for historical threat telemetry

Answer

Manual packet capture configuration for every individual vulnerability signature

Question 9

An enterprise network security architect is integrating Cortex XSIAM and Cortex XDR threat intelligence feeds with physical Palo Alto Networks NGFWs using PAN-OS services. Which THREE mechanisms are used to distribute and apply this integrated threat intelligence across the architecture? (Choose three)

Accepted Answer

Log forwarding and automated response actions via Panorama and Cortex integrations. Threat intelligence and indicators are distributed across PAN-OS architectures using External Dynamic Lists (EDLs), automated policy enforcement via Cortex XSOAR/XSIAM integrations, and direct automated threat feed synchronization to the firewalls.

Answer

Direct SNMPv2 trap broadcasting from XSIAM to individual firewall data planes

Answer

Manual USB firmware flashing of indicator database updates on every firewall

Question 10

An enterprise security architect wants to gain visibility into shadow IT and unmanaged AI applications utilized by employees across the organization. Which Palo Alto Networks solution provides this cloud application discovery and risk scoring?

Accepted Answer

Prisma Access with SaaS Security inline discovery and risk scoring. Prisma Access / Prisma Cloud / Enterprise DLP / Advanced URL Filtering provide SaaS security visibility. Specifically, Prisma Access and Advanced URL Filtering with SaaS Security provide shadow IT discovery and risk assessment.

Answer

Prisma SD-WAN branch interface counters

Answer

Cortex XDR host isolation policies

Answer

GlobalProtect portal splash page notifications